{"id":"W3150814957","doi":"","title":"Lags in the release, adoption, and propagation of npm vulnerability fixes","year":2022,"lang":"en","type":"article","venue":"Institutional Repositories DataBase (IRDB)","topic":"Software Engineering Research","field":"Computer Science","cited_by":50,"is_retracted":false,"has_abstract":false,"ca_institutions":"University of Waterloo","funders":"","keywords":"Vulnerability (computing); Software package; Business; Vulnerability assessment; Computer science; Software; Computer security; Operating system; Psychology","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.007258255,0.00019483,0.0002424466,0.002038227,0.0004884821,0.00312292,0.000785505,0.001221973,0.006565717],"category_scores_gemma":[0.09880078,0.000457544,0.0002658285,0.001806851,0.0009931703,0.003911649,0.002153695,0.002949867,0.0009590865],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.001187996,"about_ca_system_score_gemma":0.00164823,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.01337065,"about_ca_topic_score_gemma":0.01730951,"domain_scores_codex":[0.9961926,0.0005729537,0.0004469703,0.0008522425,0.001120708,0.00081451],"domain_scores_gemma":[0.8316406,0.09810429,0.04830928,0.006540386,0.01013566,0.005269779],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"observational","study_design_scores_codex":[0.0008863172,0.0003079371,0.9277138,0.000185282,0.0001635861,0.0003322473,0.003472436,0.006182794,0.00313364,0.009756449,0.003318119,0.04454734],"study_design_scores_gemma":[0.00003415612,0.0004055774,0.9791724,0.0001147744,0.00006670303,0.000194942,0.004482913,0.00698236,0.001600982,0.003145253,0.003741387,0.00005853175],"study_design_candidate":"observational","study_design_consensus":"observational","genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.9934348,0.0003392364,0.001143308,0.0008041063,0.0000404156,0.00001786131,0.0007830496,0.00007896654,0.003358394],"genre_scores_gemma":[0.9986519,0.00008939904,0.000214459,0.00004764421,0.00001153482,0.00000707956,0.0003011144,0.000009863956,0.0006670415],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.01337065,"threshold_uncertainty_score":0.03838575,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01786123814436419,"score_gpt":0.2611345482604494,"score_spread":0.2432733101160852,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}